scaffold: Docker infrastructure — Compose, Nginx, NATS, Dockerfile

4-service stack (PostgreSQL 16, NATS JetStream, Rust API, Nginx),
multi-stage Rust build with dependency caching, wildcard subdomain
routing for public sites, WebSocket support, rate limiting zones.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

docker/Dockerfile.api

@@ -0,0 +1,33 @@
+# Multi-stage build for Corrosion API
+# Stage 1: Build the Rust binary
+FROM rust:1.84-alpine AS builder
+
+RUN apk add --no-cache musl-dev pkgconfig openssl-dev openssl-libs-static
+
+WORKDIR /build
+
+# Cache dependencies — copy manifests first
+COPY Cargo.toml Cargo.lock ./
+RUN mkdir src && echo "fn main() {}" > src/main.rs
+RUN cargo build --release 2>/dev/null || true
+
+# Now copy actual source and build
+COPY src/ src/
+COPY migrations/ migrations/
+RUN touch src/main.rs && cargo build --release
+
+# Stage 2: Runtime image
+FROM alpine:3.20
+
+RUN apk add --no-cache ca-certificates
+
+WORKDIR /app
+
+COPY --from=builder /build/target/release/corrosion-api .
+COPY migrations/ migrations/
+
+ENV RUST_LOG=corrosion_api=info,tower_http=info
+
+EXPOSE 3000
+
+CMD ["./corrosion-api"]